| 123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151 |
- ; This is the ucode used to "unlock" memcards
- ; RE purely out of interest, and hunch that it does trickies
- IROM_BASE: equ 0x8000
- ; Exception vectors
- nop
- nop
- nop
- nop
- nop
- nop
- nop
- nop
- nop
- nop
- nop
- nop
- nop
- halt ; Exception 0-6 nop slide to here
- rti ; Exception 7
- halt
- ; Entry point
- ; Standard init stuff
- sbset #0x06
- sbclr #0x03
- sbclr #0x04
- sbset #0x05
- lri $CR, #0x00ff
- lri $WR0, #0xffff
- lri $WR1, #0xffff
- lri $WR2, #0xffff
- lri $WR3, #0xffff
- set40
- ; 0xdcd10000 is the init mail
- call wait_for_dsp_mbox
- si @DMBH, #0xdcd1
- si @DMBL, #0x0000
- si @DIRQ, #0x0001
- ; Wait for cpu to say "go!" - i think
- wait_for_start_cmd:
- call wait_for_cpu_mbox
- lrs $AC1.L, @CMBL
- cmpi $AC1.M, #0xff00
- jnz wait_for_start_cmd
- dma_dram_and_prepare_for_crazy_irom_func:
- call wait_for_cpu_mbox
- mrr $AC0.M, $AC1.M
- lrs $AC0.L, @CMBL ; main ram addr.l
- andi $AC0.M, #0x0fff ; main ram addr.h & 0x0fff
- lri $AX0.L, #0x0400 ; dsp addr
- lri $AX0.H, #0x0010 ; length (bytes)
- lri $AX1.L, #0x0000 ; dsp dram to cpu
- set16
- call do_dma
- call IROM_BASE+0x0644; holy mother of jesus that func is gonna be hard
- ; 0xdcd10003 means finished unlocking?
- call wait_for_dsp_mbox
- si @DMBH, #0xdcd1
- si @DMBL, #0x0003
- si @DIRQ, #0x0001
- set40
- call wait_for_cpu_mbox
- cmpi $AC1.M, #0xcdd1
- jnz dma_dram_and_prepare_for_crazy_irom_func
- lrs $AC1.M, @CMBL
- cmpi $AC1.M, #0x0001
- jz _005afunc
- cmpi $AC1.M, #0x0002
- jz IROM_BASE ; End of this ucode, wait for a new one
- jmp dma_dram_and_prepare_for_crazy_irom_func
- halt ; Prolly never reached
- ; 10 mails from cpu then irom func - looks interesting
- _005afunc:
- set16
- call wait_for_cpu_mbox
- lrs $AC1.L, @CMBL
- call wait_for_cpu_mbox
- lrs $AC1.L, @CMBL
- call wait_for_cpu_mbox
- lrs $AC1.L, @CMBL
- call wait_for_cpu_mbox
- lr $IX1, @CMBL
- andi $AC1.M, #0x0fff
- mrr $IX0, $AC1.M
- call wait_for_cpu_mbox
- lr $IX3, @CMBL
- call wait_for_cpu_mbox
- lr $IX2, @CMBL
- call wait_for_cpu_mbox
- lr $AR0, @CMBL
- call wait_for_cpu_mbox
- lrs $AX0.L, @CMBL
- andi $AC1.M, #0x0fff
- mrr $AX0.H, $AC1.M
- call wait_for_cpu_mbox
- lrs $AX1.L, @CMBL
- call wait_for_cpu_mbox
- lrs $AX1.H, @CMBL
- sbclr #0x05
- sbclr #0x06
- jmp IROM_BASE+0x00b5; IROM - can dma stuff
- halt
- wait_for_dsp_mbox:
- lrs $AC1.M, @DMBH
- andcf $AC1.M, #0x8000
- jlz wait_for_dsp_mbox
- ret
- wait_for_cpu_mbox:
- lrs $AC1.M, @CMBH
- andcf $AC1.M, #0x8000
- jlnz wait_for_cpu_mbox
- ret
- do_dma:
- srs @DSMAH, $AC0.M
- srs @DSMAL, $AC0.L
- sr @DSPA, $AX0.L
- sr @DSCR, $AX1.L
- sr @DSBL, $AX0.H
- wait_dma:
- lrs $AC0.M, @DSCR
- andcf $AC0.M, #0x0004
- jlz wait_dma
- ret
- ; Trailing nops...pad to 32bytes
- nop
- nop
- nop
- nop
- nop
- nop
- nop
- nop
- nop
- nop
- nop
- nop
- nop
- nop
- ; uCode is 0xb0 words
|
